Fixed
Created: Jan 19, 2021
Updated: Mar 2, 2021
Resolved Date: Mar 2, 2021
Found In Version: 10.19.45.1
Severity: Standard
Applicable for: Wind River Linux LTS 19
Component/s: Userspace
When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query() if the reply destination address/port is one of those used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies the attributes of a query that all must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack.
Upstream patch:
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=257ac0c5f7732cbc6aa96fdd3b06602234593aca
CREATE(Triage):(User=admin) [CVE-2020-25684|https://nvd.nist.gov/vuln/detail/CVE-2020-25684]
